News for hackers. Stuff that matters.

A comment on Comcast Shot Themselves in the Foot with MTA-STS. Parent comment

Re:Comcast Shot Themselves in the Foot with MTA-STS by tptacek on Wednesday January 19, 2022 @09:11PM (#30003479)
Your web browser should do what you tell it to, but it doesn't follow that people who provide apps are obligated to allow you to speak HTTP to them. I don't know what a "malicious specification" is, but your logic about how to lock apps into HTTPS (by simply not listening on 80/tcp) doesn't hold, at all.
[ Parent | on HN ]
Re:Comcast Shot Themselves in the Foot with MTA-STS by tedunangst on Wednesday January 19, 2022 @10:01PM (#30003928)
That's not the request being made. What people want is for the button that says "this expired cert is fine, whatever" to still be available for hsts https sites.
[ Parent | on HN ]
Re:Comcast Shot Themselves in the Foot with MTA-STS by tptacek on Wednesday January 19, 2022 @11:28PM (#30004636)
I guess I don't understand what that has to do with HSTS, which was not designed for that button.
[ Parent | on HN ]
Re:Comcast Shot Themselves in the Foot with MTA-STS by ocdtrekkie on Thursday January 20, 2022 @12:02AM (#30004882)
Basically, on any ordinary HTTPS site, every browser can allow you to proceed despite a certificate error. Such as knowing the certificate is expired or revoked or not from a known CA or something.

HSTS by specification prohibits browsers from offering that option. So I can know a server is serving valid, authentic traffic via HTTPS, be aware of why the certificate has an issue, and HSTS requires that my browser prohibit me from connecting to the server.

[ Parent | on HN ]
Re:Comcast Shot Themselves in the Foot with MTA-STS by tedunangst on Wednesday January 19, 2022 @11:50PM (#30004810)
When an HSTS locked site has an expired cert, the browser takes away the "it's okay" button.
[ Parent | on HN ]
Re:Comcast Shot Themselves in the Foot with MTA-STS by tptacek on Thursday January 20, 2022 @01:11AM (#30005384)
No, I get that. I get how you can reasonably argue about that feature. I don't get how you can argue that feature suggests we shouldn't stop SSL stripping at all.
[ Parent | on HN ]